Mark tools.github.repos and tools.github.min-integrity as experimental#18904
Merged
Mark tools.github.repos and tools.github.min-integrity as experimental#18904
Conversation
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Mark tools.github.repos and tools.github.min-integrity as experimental
Mark tools.github.repos and tools.github.min-integrity as experimental
Feb 28, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
Marks the GitHub guard policy fields (tools.github.repos / tools.github.min-integrity) as experimental by emitting a compile-time warning, consistent with existing experimental-feature warnings.
Changes:
- Emit an experimental warning when
tools.githubguard policy settings are present during workflow validation/compilation. - Add integration tests covering guard policy present/absent scenarios and asserting warning output + warning count increments.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| pkg/workflow/compiler.go | Adds an experimental warning when GitHub guard policy fields are set in tools.github. |
| pkg/workflow/guard_policy_experimental_warning_test.go | Adds integration tests verifying the guard policy warning appears only when expected. |
Comments suppressed due to low confidence (1)
pkg/workflow/guard_policy_experimental_warning_test.go:114
- The stderr capture in this test ignores errors from os.Pipe() and io.Copy(), and the read end of the pipe is never closed. Please handle/propagate those errors and close the pipe reader (e.g., via defer) to avoid leaking file descriptors and to make failures easier to debug.
oldStderr := os.Stderr
r, w, _ := os.Pipe()
os.Stderr = w
compiler := NewCompiler()
compiler.SetStrictMode(false)
err := compiler.CompileWorkflow(testFile)
// Restore stderr
w.Close()
os.Stderr = oldStderr
var buf bytes.Buffer
io.Copy(&buf, r)
stderrOutput := buf.String()
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
tools.github.reposandtools.github.min-integrity(the GitHub guard policy) are experimental features that should emit a warning at compile time, consistent with howsafe-inputs,plugins, andrate-limitare handled.Changes
pkg/workflow/compiler.go: Emits an experimental warning when either guard policy field is set:pkg/workflow/guard_policy_experimental_warning_test.go: Integration tests covering guard policy present/absent cases, following the existing experimental warning test pattern.Example
→ emits
⚠ Using experimental feature: tools.github guard policy (repos/min-integrity)on stderr during compilation.Warning
Firewall rules blocked me from connecting to one or more addresses (expand for details)
I tried to connect to the following addresses, but was blocked by firewall rules:
https://api.github.com/graphql/usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw git 64/bin/go infocmp t-11�� k/gh-aw/gh-aw/.github/workflows/auto-triage-issues.md go /usr/bin/git -json GO111MODULE 64/bin/go git(http block)/usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw git 64/bin/go git conf�� --get remote.origin.url /usr/bin/git "prettier" --wrigit git 64/bin/go git(http block)https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1/usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha runs/20260228-201413-35210/test-67476723/.github/workflows GO111MODULE 8174454/b385/vet.cfg l GOMOD GOMODCACHE node /opt�� prettier(http block)/usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 1/x64/bin/node GOINSECURE GOMOD GOMODCACHE 1/x64/bin/node(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v3/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha g_.a GO111MODULE k/_temp/uv-python-dir/node GOINSECURE tants GOMODCACHE go ache�� AyJnqvHzA GO111MODULE k/node_modules/.bin/sh GOINSECURE GOMOD GOMODCACHE ortcfg(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha -json GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v5/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha 333264351/.github/workflows GO111MODULE tions/setup/js/node_modules/.bin/prettier GOINSECURE GOMOD GOMODCACHE go env epOnly,Imports,ImportMap,TestImports,XTestImpor GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha -bool -buildtags clusion,workflowName,createdAt,startedAt,updated-nilfunc -errorsas 90 -nilfunc git rev-�� --show-toplevel -tests 8174454/b423/vet.cfg "prettier" --wrigit 4265019/b391/imprev-parse 64/bin/go git(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha user.email test@example.com /usr/bin/unpigz -json GO111MODULE es/.bin/sh /usr/bin/unpigz -d -c tDxh6_4/9rUbv3kNremote.origin.url /usr/bin/git on' --ignore-patgit GO111MODULE 64/bin/go git(http block)https://api.github.com/repos/actions/checkout/git/ref/tags/v6/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha g_.a GO111MODULE /opt/hostedtoolcache/go/1.25.0/x-test.short=true GOINSECURE util GOMODCACHE go env jpq_JbW5I GO111MODULE 8174454/b347/vet.cfg GOINSECURE GOMOD GOMODCACHE ortcfg(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 8174454/b358/vet.cfg GOINSECURE GOMOD GOMODCACHE node(http block)/usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha(http block)https://api.github.com/repos/actions/github-script/git/ref/tags/v8/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha "prettier" --wriGOINSECURE sh 64/bin/go npx prettier --cnode GOPROXY 64/bin/go sh -c npx prettier --w**/*.ts sh 64/bin/go "prettier" --chenode /opt/hostedtoolc/home/REDACTED/.npm/_npx/b388654678d519d9/node_modules/.bin/prettier 64/bin/go go(http block)/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha echo "��� JavaScGOSUMDB uname 64/bin/go tierignore /opt/hostedtoolc-c 64/bin/go go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha npx prettier --wGOSUMDB sh 64/bin/go "prettier" --chesh /opt/hostedtoolc-c de go env h ../../../.prettierignore GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/actions/setup-go/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env runs/20260228-201413-35210/test-4218384589/.github/workflows GO111MODULE 8174454/b354/vet.cfg GOINSECURE GOMOD GOMODCACHE node(http block)/usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha -json GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD erignore go env itattributes-test3270254937/.github/workflows GO111MODULE ache/node/24.13.1/x64/bin/node l GOMOD GOMODCACHE go(http block)/usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha --show-toplevel go /usr/bin/git th .prettierignogit GO111MODULE x_amd64/vet git rev-�� --show-toplevel x_amd64/vet /usr/bin/git -json GO111MODULE bin/sh git(http block)https://api.github.com/repos/actions/setup-node/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha vaScript3690109583/001/test-frontmatter-with-arr@{u} GO111MODULE 8174454/b001/importcfg.link GOINSECURE GOMOD GOMODCACHE lRah6RCjV91LC/F_bWZd-rjVLNyX80TULg/PEsHvP2B97nCcIqAZhvZ/p_lUnDIlRah6RCjV91LC env ry=1 GO111MODULE 8174454/b001/_pkg_.a GOINSECURE GOMOD run-script/lib/n--show-toplevel node(http block)/usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha -json GO111MODULE 1/x64/bin/node GOINSECURE GOMOD erignore go t-ha�� ithub/workflows/audit-workflows.md GO111MODULE /opt/hostedtoolcache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha --show-toplevel go /usr/bin/git th .prettierignogit GO111MODULE x_amd64/vet git rev-�� --show-toplevel x_amd64/vet /usr/bin/git -json GO111MODULE de_modules/.bin/--show-toplevel git(http block)https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4/usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha */*.ts' '**/*.json' --ignore-pat-test.timeout=10m0s GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha -json GO111MODULE n-dir/sh GOINSECURE GOMOD GOMODCACHE go env '**/*.ts' '**/*.json' --ignore-path ../../../.pr**/*.json GO111MODULE ndor/bin/sh GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts/usr/bin/gh gh run download 1 --dir test-logs/run-1 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh run download 1 --dir test-logs/run-1 GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env .js' --ignore-path .prettierignore GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts/usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go estl�� -json GO111MODULE 86_64/sh GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GO111MODULE bin/sh GOINSECURE GOMOD GOMODCACHE go env .js' --ignore-path .prettierignore GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts/usr/bin/gh gh run download 12346 --dir test-logs/run-12346 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go estl�� -json GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh run download 12346 --dir test-logs/run-12346 GO111MODULE h GOINSECURE GOMOD(http block)https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts/usr/bin/gh gh run download 2 --dir test-logs/run-2 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env ty-test.md GO111MODULE ndor/bin/sh GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh run download 2 --dir test-logs/run-2 GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env agent-persona-explorer.md GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts/usr/bin/gh gh run download 3 --dir test-logs/run-3 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh run download 3 --dir test-logs/run-3 GO111MODULE 8d519d9/node_modules/.bin/prettier GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts/usr/bin/gh gh run download 4 --dir test-logs/run-4 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh run download 4 --dir test-logs/run-4 GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go env agent-persona-explorer.md GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts/usr/bin/gh gh run download 5 --dir test-logs/run-5 GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh run download 5 --dir test-logs/run-5 GO111MODULE 8d519d9/node_modules/.bin/node GOINSECURE GOMOD GOMODCACHE go 8d51�� -json GO111MODULE 1/x64/bin/node GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/actions/workflows/usr/bin/gh gh workflow list --json name,state,path "prettier" --wriGOINSECURE sh 64/bin/go "prettier" --chesh GOPROXY 64/bin/go node /opt�� prettier --write 64/bin/go !../../../pkg/wo/opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/asm --ignore-path ../../../.prettierignore go(http block)/usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 c run-script/lib/node-gyp-bin/node-json go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha log.showsignatur--ignore-path log 64/bin/go -n1 --format=format:workflow b67e929f471c1028list go er -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999/usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha ty-test.md GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE 4X/C061xVfYOKCjcDjyPxD-/1pjaMAEPwhrn9NjtCOgd env 67476723/.github/workflows GO111MODULE 64/bin/node GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha h ../../../.prettierignore GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/nonexistent/repo/actions/runs/12345/usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)/usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE go env -json GO111MODULE ache/go/1.25.0/x64/bin/go GOINSECURE GOMOD GOMODCACHE go(http block)https://api.github.com/repos/owner/repo/actions/workflows/usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go **/*.json --ignore-path ../../../.pretti"prettier" --check '**/*.cjs' '**/*.ts' '**/*.json' --ignore-path ../../../.prettierignore sh -c "prettier" --wriGOSUMDB go 64/bin/go rror -e modules/@npmcli/actions/setup-cli/install.sh go(http block)/usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go **/*.json --ignore-path ../../../.pretti"prettier" --check '**/*.cjs' '**/*.ts' '**/*.json' --ignore-path ../../../.pret.prettierignore sh -c "prettier" --wriGOSUMDB git 64/bin/go rror %(refname) 64/bin/go go(http block)/usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go **/*.ts **/*.json --ignore-path sh -c npx prettier --wGOINSECURE 1/x64/bin/npm de --show-toplevel go /usr/bin/git git(http block)https://api.github.com/repos/owner/repo/contents/file.md/tmp/go-build4028174454/b380/cli.test /tmp/go-build4028174454/b380/cli.test -test.testlogfile=/tmp/go-build4028174454/b380/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true **/*.ts **/*.json --ignore-path node /opt�� run format:pkg-json 64/bin/go "prettier" --chesh /opt/hostedtoolc-c /node go(http block)/tmp/go-build4115052447/b380/cli.test /tmp/go-build4115052447/b380/cli.test -test.testlogfile=/tmp/go-build4115052447/b380/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true github.actor go /usr/bin/git sh -c "prettier" --wriGOINSECURE git 64/bin/go tierignore x_amd64/compile /usr/bin/git node(http block)https://api.github.com/repos/test-owner/test-repo/actions/secrets/usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name "prettier" --wriGOINSECURE node 64/bin/go prettier --check 64/bin/go node /opt�� prettier --write /node !../../../pkg/wogit --ignore-path ../../../.pretti--porcelain go(http block)/usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name prettier --write 64/bin/go **/*.ts **/*.json --ignore-path /bin/sh -c cd actions/setupGOINSECURE git 64/bin/go tierignore go /usr/bin/git /bin/sh(http block)If you need me to access, download, or install something from one of these locations, you can either:
Original prompt
💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.